Question

One of my systems got hit by a virus. One of the virus behavior is copying / duplicating itself using an existing file/folder name and faking its icon as folder icon. I've managed to wipe it out, but somehow there is one thing left. Every executable files now in the box listed without its .exe extension shown. For example Outlook.exe is shown as "Outlook " (without quotes) while Doc.xls is shown as it is "Doc.xls". Yes, the virus had modified a lot of registry entries and I've managed to restore them all, but I don't know how to make Explorer unhide .exe file extension. Any advice will be very much appreciated.

Answer

Method 1: Fixing the settings automatically

Download exefix_xp.com utility and save to Desktop. Double-click the file to run it. This utility fixes the exefile association in the registry automatically.

Additional tip:  To run the utility silently (without any prompts), use the -silent parameter. Open a Command window (Command.com) and type:

C:\Utilities\exefix_xp.com -silent

Assuming that the exefix_xp.com is placed in the C:\Utilities directory.

Method 2: Fixing the settings using Registry editor

  • Click Start, Run and type Regedit.exe
  • Navigate to the following branch:

HKEY_CLASSES_ROOT\exefile

  • In the right pane, delete the value named NeverShowExt
  • Close Regedit.exe

Why do Viruses make this change?

Some viruses hide the extension for executable files by adding the NeverShowExt registry value. Viruses then place an executable file with double-extension (say, vacation.jpg.exe) and make people believe that it's only an image file (.exe part is hidden as a result of creating the NeverShowExt registry value.) When the user double-clicks the file in an attempt to preview the image, the executable runs.